Vulnerability database

5,853 results · page 89 of 118

• Oct 6, 2024Bold Page Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47298 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in boldthemes Bold Page Builder bold-page-builder allows Stored XSS.This issue affects Bold Page Builder: from n/a through <= 5.1.1.

  Product

  Bold Page Builder

  Affected

  up to 5.1.1

  What to do

  Affects up to 5.1.1. Update Bold Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 6, 2024CP Polls: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47297 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codepeople CP Polls cp-polls allows Reflected XSS.This issue affects CP Polls: from n/a through <= 1.0.74.

  Product

  CP Polls

  Affected

  up to 1.0.74

  What to do

  Affects up to 1.0.74. Update CP Polls to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 6, 2024Unlimited Elements For Elementor (Free Widgets, Addons, Templates): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-45454 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Reflected XSS.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through <= 1.5.121.

  Product

  Unlimited Elements For Elementor (Free Widgets, Addons, Templates)

  Affected

  up to 1.5.121

  What to do

  Affects up to 1.5.121. Update Unlimited Elements For Elementor (Free Widgets, Addons, Templates) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 6, 2024Themify – WooCommerce Product Filter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-44046 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themifyme Themify – WooCommerce Product Filter themify-wc-product-filter allows Stored XSS.This issue affects Themify – WooCommerce Product Filter: from n/a through <= 1.5.1.

  Product

  Themify – WooCommerce Product Filter

  Affected

  up to 1.5.1

  What to do

  Affects up to 1.5.1. Update Themify – WooCommerce Product Filter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 6, 2024WP Abstracts: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-44045 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kevon Adonis WP Abstracts wp-abstracts-manuscripts-manager allows Stored XSS.This issue affects WP Abstracts: from n/a through <= 2.6.5.

  Product

  WP Abstracts

  Affected

  up to 2.6.5

  What to do

  Affects up to 2.6.5. Update WP Abstracts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 6, 2024Photo Gallery by 10Web: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-44043 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 10Web Photo Gallery by 10Web photo-gallery allows Stored XSS.This issue affects Photo Gallery by 10Web: from n/a through <= 1.8.27.

  Product

  Photo Gallery by 10Web

  Affected

  up to 1.8.27

  What to do

  Affects up to 1.8.27. Update Photo Gallery by 10Web to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 6, 2024WP Datepicker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-44042 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fahad Mahmood WP Datepicker wp-datepicker allows Stored XSS.This issue affects WP Datepicker: from n/a through <= 2.1.1.

  Product

  WP Datepicker

  Affected

  up to 2.1.1

  What to do

  Affects up to 2.1.1. Update WP Datepicker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 6, 2024IdeaPush: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-44041 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Northern Beaches Websites IdeaPush ideapush allows Stored XSS.This issue affects IdeaPush: from n/a through <= 8.66.

  Product

  IdeaPush

  Affected

  up to 8.66

  What to do

  Affects up to 8.66. Update IdeaPush to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 6, 2024Cozy Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47355 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CozyThemes Cozy Blocks cozy-addons allows Stored XSS.This issue affects Cozy Blocks: from n/a through <= 2.0.11.

  Product

  Cozy Blocks

  Affected

  up to 2.0.11

  What to do

  Affects up to 2.0.11. Update Cozy Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 6, 2024WP Bulk Delete: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47352 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xylus Themes WP Bulk Delete wp-bulk-delete allows Stored XSS.This issue affects WP Bulk Delete: from n/a through <= 1.3.1.

  Product

  WP Bulk Delete

  Affected

  up to 1.3.1

  What to do

  Affects up to 1.3.1. Update WP Bulk Delete to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 6, 2024WPMobile.App: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47349 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Amauri WPMobile.App wpappninja.This issue affects WPMobile.App: from n/a through <= 11.50.

  Product

  WPMobile.App

  Affected

  up to 11.50

  What to do

  Affects up to 11.50. Update WPMobile.App to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 6, 2024YellowPencil Visual CSS Style Editor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47348 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YellowPencil YellowPencil Visual CSS Style Editor yellow-pencil-visual-theme-customizer allows Reflected XSS.This issue affects YellowPencil Visual CSS Style Editor: from n/a through <= 7.6.4.

  Product

  YellowPencil Visual CSS Style Editor

  Affected

  up to 7.6.4

  What to do

  Affects up to 7.6.4. Update YellowPencil Visual CSS Style Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 6, 2024Chartify: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47347 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Chartify chart-builder allows Reflected XSS.This issue affects Chartify: from n/a through <= 2.7.6.

  Product

  Chartify

  Affected

  up to 2.7.6

  What to do

  Affects up to 2.7.6. Update Chartify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 6, 2024Newsletters: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47346 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tribulant Software Newsletters newsletters-lite allows Reflected XSS.This issue affects Newsletters: from n/a through <= 4.9.9.1.

  Product

  Newsletters

  Affected

  up to 4.9.9.1

  What to do

  Affects up to 4.9.9.1. Update Newsletters to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 6, 2024Starter Templates: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47345 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Starter Templates astra-sites allows Stored XSS.This issue affects Starter Templates: from n/a through <= 4.4.0.

  Product

  Starter Templates

  Affected

  up to 4.4.0

  What to do

  Affects up to 4.4.0. Update Starter Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 6, 2024Mega Elements: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47343 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kraft Plugins Mega Elements mega-elements-addons-for-elementor allows Stored XSS.This issue affects Mega Elements: from n/a through <= 1.2.4.

  Product

  Mega Elements

  Affected

  up to 1.2.4

  What to do

  Affects up to 1.2.4. Update Mega Elements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 6, 2024Accordion: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47342 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Accordion accordions allows Stored XSS.This issue affects Accordion: from n/a through <= 2.2.99.

  Product

  Accordion

  Affected

  up to 2.2.99

  What to do

  Affects up to 2.2.99. Update Accordion to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 6, 2024WP-DownloadManager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47341 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Lester Chan WP-DownloadManager wp-downloadmanager allows Reflected XSS.This issue affects WP-DownloadManager: from n/a through <= 1.68.8.

  Product

  WP-DownloadManager

  Affected

  up to 1.68.8

  What to do

  Affects up to 1.68.8. Update WP-DownloadManager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 6, 2024Post Grid and Gutenberg Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47340 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Post Grid and Gutenberg Blocks post-grid allows Stored XSS.This issue affects Post Grid and Gutenberg Blocks: from n/a through <= 2.2.89.

  Product

  Post Grid and Gutenberg Blocks

  Affected

  up to 2.2.89

  What to do

  Affects up to 2.2.89. Update Post Grid and Gutenberg Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 6, 2024WP Mail Catcher: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47339 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in JWardee WP Mail Catcher wp-mail-catcher allows Reflected XSS.This issue affects WP Mail Catcher: from n/a through <= 2.1.9.

  Product

  WP Mail Catcher

  Affected

  up to 2.1.9

  What to do

  Affects up to 2.1.9. Update WP Mail Catcher to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 6, 2024Terms descriptions: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47336 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vladimir Statsenko Terms descriptions terms-descriptions allows Stored XSS.This issue affects Terms descriptions: from n/a through <= 3.4.7.

  Product

  Terms descriptions

  Affected

  up to 3.4.7

  What to do

  Affects up to 3.4.7. Update Terms descriptions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 6, 2024Loops & Logic: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47333 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tangible Loops & Logic tangible-loops-and-logic allows Reflected XSS.This issue affects Loops & Logic: from n/a through <= 4.1.4.

  Product

  Loops & Logic

  Affected

  up to 4.1.4

  What to do

  Affects up to 4.1.4. Update Loops & Logic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 6, 2024Sky Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47332 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wowDevs Sky Addons for Elementor sky-elementor-addons allows Stored XSS.This issue affects Sky Addons for Elementor: from n/a through <= 2.5.11.

  Product

  Sky Addons for Elementor

  Affected

  up to 2.5.11

  What to do

  Affects up to 2.5.11. Update Sky Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 6, 2024ElementsReady Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47329 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in quomodosoft ElementsReady Addons for Elementor element-ready-lite allows Cross-Site Scripting (XSS).This issue affects ElementsReady Addons for Elementor: from n/a through <= 6.4.0.

  Product

  ElementsReady Addons for Elementor

  Affected

  up to 6.4.0

  What to do

  Affects up to 6.4.0. Update ElementsReady Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 6, 2024GEO my: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47327 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Eyal Fitoussi GEO my WordPress geo-my-wp allows Reflected XSS.This issue affects GEO my WordPress: from n/a through <= 4.5.0.3.

  Product

  GEO my

  Affected

  up to 4.5.0.3

  What to do

  Affects up to 4.5.0.3. Update GEO my to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 6, 2024Share This Image: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47326 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ILLID Share This Image share-this-image allows Reflected XSS.This issue affects Share This Image: from n/a through <= 2.01.

  Product

  Share This Image

  Affected

  up to 2.01

  What to do

  Affects up to 2.01. Update Share This Image to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 6, 2024Premium Blocks – Gutenberg Blocks for: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47368 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Leap13 Premium Blocks – Gutenberg Blocks for WordPress premium-blocks-for-gutenberg allows Stored XSS.This issue affects Premium Blocks – Gutenberg Blocks for WordPress: from n/a through <= 2.1.33.

  Product

  Premium Blocks – Gutenberg Blocks for

  Affected

  up to 2.1.33

  What to do

  Affects up to 2.1.33. Update Premium Blocks – Gutenberg Blocks for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 6, 2024YITH WooCommerce Product Add-Ons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47367 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITHEMES YITH WooCommerce Product Add-Ons yith-woocommerce-product-add-ons allows Reflected XSS.This issue affects YITH WooCommerce Product Add-Ons: from n/a through <= 4.13.0.

  Product

  YITH WooCommerce Product Add-Ons

  Affected

  up to 4.13.0

  What to do

  Affects up to 4.13.0. Update YITH WooCommerce Product Add-Ons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 6, 2024Elementor Addon Elements: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47366 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPVibes Elementor Addon Elements addon-elements-for-elementor-page-builder allows Stored XSS.This issue affects Elementor Addon Elements: from n/a through <= 1.13.6.

  Product

  Elementor Addon Elements

  Affected

  up to 1.13.6

  What to do

  Affects up to 1.13.6. Update Elementor Addon Elements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 6, 2024Automatically Hierarchic Categories in Menu: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47365 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Atakan Au Automatically Hierarchic Categories in Menu automatically-hierarchic-categories-in-menu allows Stored XSS.This issue affects Automatically Hierarchic Categories in Menu: from n/a through <= 2.0.5.

  Product

  Automatically Hierarchic Categories in Menu

  Affected

  up to 2.0.5

  What to do

  Affects up to 2.0.5. Update Automatically Hierarchic Categories in Menu to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 6, 2024Move Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47364 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in moveaddons Move Addons for Elementor move-addons allows Stored XSS.This issue affects Move Addons for Elementor: from n/a through <= 1.3.4.

  Product

  Move Addons for Elementor

  Affected

  up to 1.3.4

  What to do

  Affects up to 1.3.4. Update Move Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 6, 2024Blockspare: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47363 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Blockspare Blockspare blockspare allows Stored XSS.This issue affects Blockspare: from n/a through <= 3.2.4.

  Product

  Blockspare

  Affected

  up to 3.2.4

  What to do

  Affects up to 3.2.4. Update Blockspare to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 6, 2024BA Book Everything: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47360 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bookingalgorithms BA Book Everything ba-book-everything.This issue affects BA Book Everything: from n/a through <= 1.6.20.

  Product

  BA Book Everything

  Affected

  up to 1.6.20

  What to do

  Affects up to 1.6.20. Update BA Book Everything to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 6, 2024Happy Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47357 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HappyMonster Happy Addons for Elementor happy-elementor-addons allows Stored XSS.This issue affects Happy Addons for Elementor: from n/a through <= 3.12.0.

  Product

  Happy Addons for Elementor

  Affected

  up to 3.12.0

  What to do

  Affects up to 3.12.0. Update Happy Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 6, 2024Create: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47356 · WordPress plugins & themes · reported by PatchstackMedium 5.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in catchthemes Create create allows Stored XSS.This issue affects Create: from n/a through <= 2.9.1.

  Product

  Create

  Affected

  up to 2.9.1

  What to do

  Affects up to 2.9.1. Update Create to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 5, 2024BuddyForms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47377 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themekraft BuddyForms buddyforms allows Stored XSS.This issue affects BuddyForms: from n/a through <= 2.8.12.

  Product

  BuddyForms

  Affected

  up to 2.8.12

  What to do

  Affects up to 2.8.12. Update BuddyForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 5, 2024Slideshow Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47376 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tribulant Software Slideshow Gallery slideshow-gallery allows Cross-Site Scripting (XSS).This issue affects Slideshow Gallery: from n/a through <= 1.8.3.

  Product

  Slideshow Gallery

  Affected

  up to 1.8.3

  What to do

  Affects up to 1.8.3. Update Slideshow Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 5, 2024XLTab – Accordions and Tabs for Elementor Page Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47375 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webangon XLTab – Accordions and Tabs for Elementor Page Builder xl-tab allows Stored XSS.This issue affects XLTab – Accordions and Tabs for Elementor Page Builder: from n/a through <= 1.3.

  Product

  XLTab – Accordions and Tabs for Elementor Page Builder

  Affected

  up to 1.3

  What to do

  Affects up to 1.3. Update XLTab – Accordions and Tabs for Elementor Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 5, 2024LiteSpeed Cache: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47374 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Stored XSS.This issue affects LiteSpeed Cache: from n/a through <= 6.5.0.2.

  Product

  LiteSpeed Cache

  Affected

  up to 6.5.0.2

  What to do

  Affects up to 6.5.0.2. Update LiteSpeed Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 5, 2024LiteSpeed Cache: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47373 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Stored XSS.This issue affects LiteSpeed Cache: from n/a through <= 6.5.0.2.

  Product

  LiteSpeed Cache

  Affected

  up to 6.5.0.2

  What to do

  Affects up to 6.5.0.2. Update LiteSpeed Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 5, 2024TNC PDF viewer: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-47372 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in ThemeNcode LLC TNC PDF viewer allows Stored XSS.This issue affects TNC PDF viewer: from n/a through 3.1.0.

  Product

  TNC PDF viewer

  Affected

  up to 3.1.0

  What to do

  Affects up to 3.1.0. Update TNC PDF viewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 5, 2024WP MyLinks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47371 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Walter Pinem WP MyLinks wp-mylinks allows Stored XSS.This issue affects WP MyLinks: from n/a through <= 1.0.6.

  Product

  WP MyLinks

  Affected

  up to 1.0.6

  What to do

  Affects up to 1.0.6. Update WP MyLinks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 5, 2024Author Avatars List/Block: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47370 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Paul Bearne Author Avatars List/Block author-avatars allows Stored XSS.This issue affects Author Avatars List/Block: from n/a through <= 2.1.21.

  Product

  Author Avatars List/Block

  Affected

  up to 2.1.21

  What to do

  Affects up to 2.1.21. Update Author Avatars List/Block to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 5, 2024Social Auto Poster: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47369 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpweb Social Auto Poster social-auto-poster allows Reflected XSS.This issue affects Social Auto Poster: from n/a through <= 5.3.15.

  Product

  Social Auto Poster

  Affected

  up to 5.3.15

  What to do

  Affects up to 5.3.15. Update Social Auto Poster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 5, 2024BSK Forms Blacklist: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47624 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bannersky BSK Forms Blacklist bsk-gravityforms-blacklist allows Reflected XSS.This issue affects BSK Forms Blacklist: from n/a through <= 3.8.1.

  Product

  BSK Forms Blacklist

  Affected

  up to 3.8.1

  What to do

  Affects up to 3.8.1. Update BSK Forms Blacklist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 5, 2024Gallery Lightbox: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47623 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GhozyLab Gallery Lightbox gallery-lightbox-slider allows Stored XSS.This issue affects Gallery Lightbox: from n/a through <= 1.0.0.39.

  Product

  Gallery Lightbox

  Affected

  up to 1.0.0.39

  What to do

  Affects up to 1.0.0.39. Update Gallery Lightbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 5, 2024Advanced Woo Labels: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47622 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ILLID Advanced Woo Labels advanced-woo-labels allows Stored XSS.This issue affects Advanced Woo Labels: from n/a through <= 2.01.

  Product

  Advanced Woo Labels

  Affected

  up to 2.01

  What to do

  Affects up to 2.01. Update Advanced Woo Labels to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 5, 2024Zotpress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47621 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Katie Zotpress zotpress allows Stored XSS.This issue affects Zotpress: from n/a through <= 7.3.10.

  Product

  Zotpress

  Affected

  up to 7.3.10

  What to do

  Affects up to 7.3.10. Update Zotpress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 5, 2024Robokassa payment gateway for Woocommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47395 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in robokassa Robokassa payment gateway for Woocommerce robokassa allows Reflected XSS.This issue affects Robokassa payment gateway for Woocommerce: from n/a through <= 1.6.1.

  Product

  Robokassa payment gateway for Woocommerce

  Affected

  up to 1.6.1

  What to do

  Affects up to 1.6.1. Update Robokassa payment gateway for Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 5, 2024JobSearch: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47394 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eyecix JobSearch wp-jobsearch allows Reflected XSS.This issue affects JobSearch: from n/a through <= 2.5.9.

  Product

  JobSearch

  Affected

  up to 2.5.9

  What to do

  Affects up to 2.5.9. Update JobSearch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.